Mike Miller wrote:

> On Tue, 19 Oct 2004, Richard Hoffbeck wrote:


> VMS is light years ahead of stock Linux as regards host security. Its 
> object based security model is pretty much the same as the one in 
> NT/2000/XP which works pretty well if developers take the time to do 
> the analysis, but even simple things like access control lists make a 
> big difference and have only recently shown up in Linux.
>
> I don't know the technical details so I won't argue, but this is the 
> first time someone has suggested to me that NT may be superior to 
> Linux in any domain of security.  I am aware of access control lists 
> and we want to use them on Linux.  I agree that it makes a big 
> difference in our working environment and that VMS seems to have an 
> edge there, but it won't last long.  Access control lists are bound to 
> be widely implemented in Linux soon enough and I think they are 
> available in some filesystems already.
>
The Windows security model is actually pretty sophisticated, but MS 
ignores most of it in the name of user/administrator convenience. If I 
remember correctly, the Navy's document on changing security settings 
for a stock NT 4.0 installation to properly secure it ran to 120 pages.  
Once the SE Linux security provider becomes commonplace Windows will 
have to play catch-up.  The point is that for what you have to pay for 
VMS applications software the vendor can afford to document what 
permissions are required for the application to run properly, but still 
be secure.

>
>> The thing to keep in mind about VMS is that it hasn't been updated 
>> significantly since the days when all networks were considered 
>> trusted so its going to be much better against attacks on host 
>> security rather than those coming through the network - actually the 
>> same seems to be true of most of the IT folks around here :-)
>
>
> Sure, but I consider attacks via the network to be much more serious 
> and much more problematic.  On Linux/UNIX systems, I can name a dozen 
> or so times that I, or friends of mine, have been cracked via the net, 
> but not one time when it was an inside job.
>
Again, that's exactly my point. Most IT folks around here are very naive 
about network security so the desirability of using ssh over telnet is 
lost on them. There is an attitude that once you cross the U's border 
firewalls everyone is nice and can be trusted. So they see no problem 
with telnet or ftp.

>> I can certainly understand the cases where there are long-term 
>> projects tied to applications developed against software tightly tied 
>> to VMS - think CCCS or ARIC - where the cost of redeploying the 
>> applications isn't funded.  But only a complete idiot would be doing 
>> new development against VMS. The Alpha chip is toast, there's no 
>> migration/upgrade path, support is going away, software is 
>> expensive/obsolete/proprietary, ... stop me anytime ...  :-)
>
>
> No - keep going!  ;-)
>
> We have long-term projects that may be locked into VMS, but most work 
> can be done on other systems.  We need to move as much work as 
> possible off of VMS.  We can do this gradually, but we must do it.  
> Reducing the burden on the VMS servers will help the projects that are 
> truly locked into VMS.
>
> My choice of OS for our next bunch of servers is Linux.  I think some 
> filesystems are already implementing access control lists, but that is 
> one of the only things I really want that we don't have.  Am I missing 
> anything?  Linux seems very stable and robust now, but I would like to 
> be contradicted on this point if any of you believe that Linux is not 
> so stable and that there are better solutions.

I hope its a good idea. I'm in the process of migrating our 
file/print/authentication services off Windows to a Linux box, and all 
of our database & web apps have been running on Linux for a couple of 
years now. 

But look at it from the IT managers point of view. You've got 100+ 
people set up for user authentication against VMS with no easy way to 
utilize that service from Linux/Solaris/etc. So you can require users to 
have accounts on both the new and old system, or you spring for 
proprietary software to keep passwords in sync or export the 
authentication services - I'm pretty sure there's a 3rd party NFS/NIS 
package available and of course there is always PathWorks (if clear text 
passwords don't bother you) but they both co$t. And then there's the 
training costs to move development over to a new system and the ongoing 
cost of administering two systems during the transition. That generates 
a lot of inertia even if it is a good idea to switch.

Just pray they don't find out about 
http://freshmeat.net/projects/freevms/ :-)

--rick


_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
Help beta test TCLUG's potential new home: http://plone.mn-linux.org
Got pictures for TCLUG? Beta test http://plone.mn-linux.org/gallery
tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list